I enter a username and a password. If it's important I set up 2FA and use a timed code or SMS if I have to.
New flow:
I try to log in using my email address. The site generates a code that I now have to go and fish out of my email, cut, and paste in, to get into the site, instead of just proceeding to enter the password that's in my password manager.
Am I the only one that thinks this new approach to logging in just sucks?
I have dealt with a lot of family members who absolutely cannot be trusted to remember even a single password if they don't have to type it in semi-regularly. I've have family members locked out of password vaults because 2 weeks is too long to expect them to remember a password.
This is who that flow is catering to. It's a significant amount of people, sadly.
What would be better is the issuance of limited permissions for other context in the form of less secure tokens. An example of this is the old school example of logging into your airline account and printing out your tickets to take to the airport.
"Today, you sign in to Google on a page that includes both the ‘email’ and ‘password’ fields on the same page. We’ll be gradually splitting those two fields into separate pages in the coming days; the sign-in process won’t change otherwise.
As we’ve said many times, we're working towards introducing new authentication solutions that complement traditional passwords. We’ve already separated the ‘username’ and ‘password’ fields onto separate pages on a successful launch in Android last year. This change to our web sign-in page is another step in that direction.
To help make sign-in easier and more personal, you may see a screen with your profile picture and full name when signing in to Google. We’ll only show this information if you are signing in from a location or device you’ve signed in from before, like your home computer."
> we're working towards introducing new authentication solutions that complement traditional passwords
Could that be done on a single page instead of a new page? Probably, but does turning the login into an SPA really reduce friction enough to make it worth that complexity?
In any case, some systems have a reason. But you are correct that doing such a thing without a good reason is not a wise move. And outside of B2B apps... I don't see it being a common thing.
A big problem is captive browser cookies. Gmail for example uses a captive browser for links. The flow from Safari --> Gmail --> captive browser means that your login session is lost in captive browser limbo.
Authentication is so kludgy, and all the attempts at securing it lead to horrific UX.
How many screens does it take to log in:
1. enter username,
2. enter password
3. enter 2fa,
4. verify email
5. open email inbox
6. open email with code
7. Open captive browser
8 ( if you are lucky) Open the original browser to log in.
8 screens that each could succeed or fail or the user can get lost.
What I'm more bothered about is that sites who use traditional username/email and password increasingly don't actually seem to care about my password. They always require 2FA, email or phone, and I don't have a choice. Username + password simply isn't good enough for these people anymore.
I agree that it's pretty frustrating, since I have strong passwords in my password manager. Like another poster, I assume its used because it provides better security for the majority.